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25X1A MEMORANDUM FOR: | 


SUBJECT : Revision of the PRIM Detailed System 
Requirements Document 


The following area in the PRIM Detailed System Requirements 
Document has been revised to clarify the term of "TEMPEST". 


3.3.6.3 TEMPEST page 47 


3.3.6.3.1 Tempest - Equipment Outside 
Headquarters page 47 


3.3.6.3.2 Tempest - Equipment Inside 
Headquarters page 47.1 


Please insert these pages in your document. If you have 
any Peet af ™ 2 es PRIM Project Leader 25X1A 


25X1A or myself on o5X1A 


IM Tea 


Document becomes 
UNCLASSIFIED when 
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33462 Component Data - (M) 


Update and retrieval capabilities of component data must be available 
to the component users. The capability to update must be controlled 
separately from the capability to retrieve component data. Likewise, 
the capability to retrieve each type of component data, i.e., future 
personnel assignments, Career Management data, and Directorate-Level 
data must be controlled Separately. Each component manager must iden- 
tify each capability required for each System user, and notify the 
PRIM Data Base Manager. 


In Release 2 the Data Base Manager will create a new Sysman2 en- 
try which will provide the update capability to only those individuals 
identified by the component. A limited number of designated users, 
determined by the component managers, will be given the capability to 
add, change, and delete data in the component files. 


3:35 Software 


Security requirements for the PRIM software are different between the 
development/maintenance versions and the production versions. Produc- 
tion software must be kept separate from any PRIM software being 
changed, and the discipline required to change Production software 
must follow strict procedures. Knowledge about the PRIM System soft- 
ware related to controlling read and/or write access must be limited 
to a need to know basis. 


39.531 Production Software - (M) 


The PRIM software identified as the latest production release must be 
completely isolated from all development activity. There must be 
stringent control procedures established for updating the PRIM produc- 
tion software. The version of the PRIM software accepted by the User 
must be the version baselined as operational. 


Ise 54 2 Development/Maintenance Software - (M) 


The PRIM software in development/maintenance must be carefully con- 
trolled and documented so all personnel involved are totally aware of 
the status. All PRIM software must be thoroughly tested using an Ac- 
ceptance Test Plan and must be accepted by the User before it is moved 
to the Production System. 
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3.3 vw System Software - (M) 


All of the Data Base Management System software related to controlling 
read and/or write access to the PRIM System and to data in the PRIN 
System is highiy sensitive and must be limited to only the individuals 
needing the information. 


] 
ri 


The Agency s Regulation on Computer secu esey | controls the 
nardware security for the PRIM System The term hardware is defined 
as the computer, all peripherals (storave oe printers, termi- 
nais), and transmission equipment (lines, modems, crypto gear). All 
equipment, existing and new, must comply to this regulation and once 
classified data is stored in the PRIM Data Base, this equipment must 
be approved for classified use. 


3.3.6.1 Existing Equipment - (D) 
pment within the 


ve 
neerning computer 


The PRIM System must initially utilize existing equ 
Agency, complying with all security regulations co 
equipment. 


3.3.6.2 New Equipment - (4M) 
Any new equipment, specifically terminals or printers, acquired by the 


components must be coordinated through normal Agency channels, and 
must comply to standard Agency computer security regulations. 


3304.5 Tempest - (M) 
All Acceptance Testing and Production activity performed outside of 


our Headquarters building must utilize only equipment approved for 
classified use. 


3.3.6.3.1 Tempest - Equipment Outside Headquarters 


Equipment used outside the Headquarters building in the PRIM system 
must meet the requirements of NACSIM 51004. 
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| 3.3.6.3.2 Tempest - Equipment Inside Headquarters 
| Equipment located in the Headquarters building must be National Secur- 


| ity Agency (NSA) zone 1, 2, or 3 equipment listed in "Tempest Zone As- 
| signments for Information Processing Equipment." 77 mer WACSIM 
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